FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-002 Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program: PPHF Geriatric Education Centers Assistance Listings Number: 93.969 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The University expended $831,232 in PPHF Geriatric Education Centers funds during the audit period. Of that amount, $309,264 was passed through to three subrecipients. As a pass-through entity, the University was required to identify the award and applicable requirements and monitor the subrecipient. Procedures to monitor its subrecipients included the following: Reviewing financial and programmatic reports as required by the University. Following up and ensuring the subrecipient takes timely and appropriate actions on all deficiencies pertaining to the federal award provided to the subrecipient detected through audits, on-site reviews, and other means. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient. INDIANA STATE BOARD OF ACCOUNTS 17 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Two of the three subrecipients expended more than $750,000 in federal awards in fiscal year 2023, thus subjecting each to a Single Audit as required by the Uniform Guidance. As such, both subrecipients were required to submit a Single Audit report to the Federal Audit Clearinghouse (FAC) by March 31, 2024. The University should have expected that the two subrecipients would receive a Single Audit report as both subrecipients were subject to a Single Audit for multiple years leading up to 2023. However, the University did not obtain a copy of either subrecipient's 2023 Single Audit report. Obtaining and reviewing Single Audit reports of subrecipients is a required component of conducting proper monitoring of subrecipients. The lack of proper monitoring would not have allowed the University to follow up and ensure that the subrecipients took timely and appropriate action on all deficiencies pertaining to the federal awards passed through to the subrecipients from the University. In addition, it would not have allowed for the University to issue a management decision for audit findings pertaining to the federal award provided to the subrecipient within six months of acceptance by the FAC. The lack of effective internal controls was a systemic issue throughout the audit period. The noncompliance was isolated to two of the University's three subrecipients during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. . . ." INDIANA STATE BOARD OF ACCOUNTS 18 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.521(d) states in part: ". . . The federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The University's management had not designed or implemented a system of internal controls to ensure that subrecipient audit reports were received and reviewed. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, subrecipients to whom payments were made were not adequately monitored. The failure to establish a sufficient system of internal controls allowed noncompliance with the grant agreements and the Subrecipient Monitoring compliance requirement. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with the federal regulations. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Reference Number: 2024-001 Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Compliance Requirement: Activities Allowed or Unallowed Award Period: Fiscal Year 2024 Award Number: Unknown Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control- Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During their disbursement review and approval process, the County did not verify reimbursement requests excluded unallowable costs. Questioned Costs: $0 Cause: The County’s procedures and controls were not sufficient to prevent payment for unallowable costs. Effect: Federal funds may have been used for purposes that are not in accordance with the terms of the grant agreement. Repeat Finding: No Recommendation: We recommend all reimbursements and payments be reviewed in detail to ensure no payments are funding unallowable costs. Views of Responsible Officials: Management agrees with the finding. See attached corrective action plan.
Reference Number: 2024-002 Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Compliance Requirement: Procurement & Suspension & Debarment Award Period: Fiscal Year 2024 Award Number: Unknown Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control- Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: Non-Federal entities other than states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. Condition/Context: When awarding contracts the County did not follow procurement policies in place at the County or outlined in the Uniform Guidance. Questioned Costs: Undetermined Cause: The County’s procedures and controls were not sufficient during the procurement process for awarding contracts. Effect: Two contracts exceeding the simplified acquisition threshold were not bid out to provide full and open competition. Repeat Finding: No Recommendation: We recommend the County follow procurement policies in place at the County or outlined in the Uniform Guidance. Views of Responsible Officials: Management agrees with the finding. See attached corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Eucation Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: (1) Minimum wages. (i) All laborers and mechanics employed or working upon the site of the work (or under the United States Housing Act of 1937 or under the Housing Act of 1949 in the construction or development of the project), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics… (3)(ii)(A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). 2 CFR 200 Appendix II states in part: In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week.. . .” Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs: There were no questioned costs identified. Context: For the one project sampled for Davis-Bacon requirements, the School Corporation did not obtain the weekly payroll reports certifications from the company that performed renovations on the School Corporation. Therefore, no review was performed to ensure that pay rates complied with the federal wage rate requirements. Additionally, the School Corporation did not have a contract with the company that included the clause for the federal wage rate requirements. The amount disbursed and reported on the SEFA during the audit period is $231,000. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-004. Recommendation: We recommend the School Corporation implement a formal process to ensure the required weekly payroll reports certifications are collected and reviewed to ensure compliance with the wage rate requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Eucation Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: (1) Minimum wages. (i) All laborers and mechanics employed or working upon the site of the work (or under the United States Housing Act of 1937 or under the Housing Act of 1949 in the construction or development of the project), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics… (3)(ii)(A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). 2 CFR 200 Appendix II states in part: In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week.. . .” Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs: There were no questioned costs identified. Context: For the one project sampled for Davis-Bacon requirements, the School Corporation did not obtain the weekly payroll reports certifications from the company that performed renovations on the School Corporation. Therefore, no review was performed to ensure that pay rates complied with the federal wage rate requirements. Additionally, the School Corporation did not have a contract with the company that included the clause for the federal wage rate requirements. The amount disbursed and reported on the SEFA during the audit period is $231,000. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-004. Recommendation: We recommend the School Corporation implement a formal process to ensure the required weekly payroll reports certifications are collected and reviewed to ensure compliance with the wage rate requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Activities Allowed or Unallowed, Allowable Costs/Cost Principles compliance requirements could result in the loss of future federal funds to the School Corporation. Questioned Costs: $61,841 (Known) Context: For testing of activities allowed and unallowed, a sample of 21 vendor vouchers were selected for testing. Two vouchers totaling $61,841 were related to disbursements for floor replacement costs incurred and charged to the ESSER III grant award. The School Corporation received approval from the Indiana Department of Education (IDOE) through the grant application to utilize a portion of the ESSER II grant award for floor replacement throughout the School Corporation. During the audit period, the School Corporation had $88,600 that was disbursed and reported on the SEFA for ESSER II and $142,400 that was disbursed and reported on the SEFA for ESSER III for floor replacement. The School Corporation did not receive approval from the Indiana Department of Education (IDOE) to use ESSER III funding for the flooring project as required for construction or remodeling related projects. The total amount of the flooring project funded by the ESSER III grant, including amounts paid prior to the audit, was $219,992. The portion of the flooring project paid by the ESSER II grant was $163,000 which was properly approved by IDOE. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements to ensure only allowable costs are charged to the grant award. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name - 10.558, U.S. Department of Agriculture, Child Care and Adult Food Program Federal Award Identification Number and Year - 15-016-271P-00, 2024 and 2023 Pass through Entity - Illinois State Board of Education Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - Yes 2023-005 Criteria - Per 2 CFR 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Other requirements include the following: (a) Per 7 CFR 226.15(f), each sponsoring organization of day care homes shall determine which of the day care homes under its sponsorship are eligible as tier I day care homes. (b) As required under 7 CFR 226.16(d)(4)(iii), sponsoring organizations are required to perform on site monitoring of each of its facilities three times every year, which includes requirements to ensure the amount of time between reviews does not exceed six months (unless review average is used). Condition - There was a lack of documented controls as evidence of supervisory review and segregation of duties to ensure compliance with federal program requirements, specifically over the following: a) Tier (day care home eligibility) determinations b) Subrecipient monitoring Noncompliance was identified for subrecipient monitoring as noted in the context below. Questioned Costs - None Identification of How Questioned Costs Were Computed - N/A - No instances of noncompliance result in questioned costs. Context (a) While gaining an understanding of controls over tier (day care home eligibility) determinations, we noted no controls established to ensure supervisory review of these determinations. (b) While testing a sample of 56 provider monitoring visits, we noted 35 day care homes and 1 day care center with less than the required 3 annual on site monitoring visits for the year and 40 day care homes for which time between on site monitoring visits exceeded six months. Cause and Effect - A lack of effectively designed, implemented, and operating controls in any of these areas could result in future material noncompliance with program requirements or the Uniform Guidance in the future. The deficiency in operating controls for subrecipient monitoring resulted in noncompliance for fiscal year 2024. Recommendation - We recommend management formalize documentation of a supervisory review of the following: (a) Data used in making tier/eligibility determinations for accuracy and completeness (b) Subrecipient monitoring Views of Responsible Officials and Corrective Action Plan - Management agrees with the recommendations and plans the following: (a) Management is working with the Software company staff to develop software based evidence of second review. If this is not possible, a tracking mechanism external to the software will be developed by March 2025. (b) Under management’s supervision, monitoring visits are being brought current on the contract currently in place and will be completed as required by end of the contract. A tracking mechanism has been put in place to ensure compliance with the required number of monitoring visits and timeliness.
Finding Number: 2024‐001 Repeat Finding: No Program Names/Assistance Listing Titles: Assistance Listing Numbers: Federal Award Numbers: Questioned Costs: Emergency Connectivity Fund 32.009 ECF202208394 $141,445 Education Stabilization Fund 84.425 S425U210038 141,445 Federal Agencies: Department of Education and USAC Pass‐Through Agencies: Arizona Department of Education and USAC Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Criteria Management is responsible for establishing and maintaining internal controls over its accounting records. Further, in accordance with 2 CFR 200.510, the District is responsible for the design and implementation of controls over the preparation of the Schedule of Expenditures of Federal Awards (SEFA) each fiscal year. Additionally, 2 CFR 200.303 requires the District establish and maintain internal control over the federal awards that provides reasonable assurance that the District is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition The District was awarded several new Federal grants in response to the COVID‐19 pandemic, which made proper preparation of the SEFA challenging and the District failed to include the new grant on the fiscal year 2022 SEFA. The District also submitted the same expenditures for reimbursement for two federal programs. Cause The District did not account for the Emergency Connectivity Fund (ECF) properly as the program was unique and not part of the District’s normal federal program operations. It was not known that the program was subject to Single Audit. In addition, there was a lack of financial oversight of the ECF grant application submitted by the Technology Department during fiscal year 2022. Effect The District received reimbursements for two federal grants, one for the Education Stabilization Fund in fiscal year 2022 and the other for the ECF grant in fiscal year 2024, for expenditures totaling $141,445. In addition, the fiscal year 2022 SEFA was incorrect as the ECF expenditures were not included on the SEFA; however, it was determined the error did not have an effect on the selection of major federal programs. Context During fiscal year 2021‐22, the District applied for and was approved for funding under the Universal Service Company (USAC)'s Emergency Connectivity Fund (ECF). The District, in conjunction with its consultant, submitted expenditures from two purchase orders to USAC's ECF for purchases made in fiscal year 2021‐22, one of which was paid for and previously reimbursed under the Education Stabilization Fund. The District received the USAC ECF reimbursement in fiscal year 2023‐24. The sample was not intended to be, and was not, a statistically valid sample. Recommendation The District should ensure all federal programs are properly reviewed prior to submitting any applications or expenditures for reimbursements. The expenditures should be included in the SEFA for the fiscal year in which the expenditures occurred. In addition, the District should strengthen controls over the accounting records to ensure reimbursements are not submitted for multiple programs. Views of Responsible Officials See Corrective Action Plan.
Finding Number: 2024‐001 Repeat Finding: No Program Names/Assistance Listing Titles: Assistance Listing Numbers: Federal Award Numbers: Questioned Costs: Emergency Connectivity Fund 32.009 ECF202208394 $141,445 Education Stabilization Fund 84.425 S425U210038 141,445 Federal Agencies: Department of Education and USAC Pass‐Through Agencies: Arizona Department of Education and USAC Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Criteria Management is responsible for establishing and maintaining internal controls over its accounting records. Further, in accordance with 2 CFR 200.510, the District is responsible for the design and implementation of controls over the preparation of the Schedule of Expenditures of Federal Awards (SEFA) each fiscal year. Additionally, 2 CFR 200.303 requires the District establish and maintain internal control over the federal awards that provides reasonable assurance that the District is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition The District was awarded several new Federal grants in response to the COVID‐19 pandemic, which made proper preparation of the SEFA challenging and the District failed to include the new grant on the fiscal year 2022 SEFA. The District also submitted the same expenditures for reimbursement for two federal programs. Cause The District did not account for the Emergency Connectivity Fund (ECF) properly as the program was unique and not part of the District’s normal federal program operations. It was not known that the program was subject to Single Audit. In addition, there was a lack of financial oversight of the ECF grant application submitted by the Technology Department during fiscal year 2022. Effect The District received reimbursements for two federal grants, one for the Education Stabilization Fund in fiscal year 2022 and the other for the ECF grant in fiscal year 2024, for expenditures totaling $141,445. In addition, the fiscal year 2022 SEFA was incorrect as the ECF expenditures were not included on the SEFA; however, it was determined the error did not have an effect on the selection of major federal programs. Context During fiscal year 2021‐22, the District applied for and was approved for funding under the Universal Service Company (USAC)'s Emergency Connectivity Fund (ECF). The District, in conjunction with its consultant, submitted expenditures from two purchase orders to USAC's ECF for purchases made in fiscal year 2021‐22, one of which was paid for and previously reimbursed under the Education Stabilization Fund. The District received the USAC ECF reimbursement in fiscal year 2023‐24. The sample was not intended to be, and was not, a statistically valid sample. Recommendation The District should ensure all federal programs are properly reviewed prior to submitting any applications or expenditures for reimbursements. The expenditures should be included in the SEFA for the fiscal year in which the expenditures occurred. In addition, the District should strengthen controls over the accounting records to ensure reimbursements are not submitted for multiple programs. Views of Responsible Officials See Corrective Action Plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 7 CFR 245.3(c) sates in part: Each School Food Authority shall serve free and reduced price meals or free milk in the respective programs to children eligible under its eligibility criteria. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guidelines used by the food service software. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and eligibility compliance requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 7 CFR 245.3(c) sates in part: Each School Food Authority shall serve free and reduced price meals or free milk in the respective programs to children eligible under its eligibility criteria. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guidelines used by the food service software. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and eligibility compliance requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 7 CFR 245.3(c) sates in part: Each School Food Authority shall serve free and reduced price meals or free milk in the respective programs to children eligible under its eligibility criteria. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guidelines used by the food service software. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and eligibility compliance requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 7 CFR 245.3(c) sates in part: Each School Food Authority shall serve free and reduced price meals or free milk in the respective programs to children eligible under its eligibility criteria. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with eligibility requirements. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: There were no questioned costs identified. Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guidelines used by the food service software. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and eligibility compliance requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.430 states in part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: $2,130 (Known questioned costs) Context: For 5 selections, in a sample of 5 payroll transactions, the School Corporation did not have time and effort logs to support the portion of the employees’ time charged to the grant. The employees’ time was split with a non-federal fund; however, the School Corporation did not have support for the allocation of the time charged to the School Lunch fund. Identification as a repeat finding: No. Recommendation: We recommend management ensure semi-annual certifications are completed for all employees charged to the grant awards at 100% and time and effort logs are maintained for all employees not charged at 100% to support work performed and charged to the grant awards. We recommend management establish a documented review by management of semi-annual certifications and time and effort logs to ensure time charged to grant awards is allowable and allocable based on work performed in accordance with grant requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.430 states in part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: $2,130 (Known questioned costs) Context: For 5 selections, in a sample of 5 payroll transactions, the School Corporation did not have time and effort logs to support the portion of the employees’ time charged to the grant. The employees’ time was split with a non-federal fund; however, the School Corporation did not have support for the allocation of the time charged to the School Lunch fund. Identification as a repeat finding: No. Recommendation: We recommend management ensure semi-annual certifications are completed for all employees charged to the grant awards at 100% and time and effort logs are maintained for all employees not charged at 100% to support work performed and charged to the grant awards. We recommend management establish a documented review by management of semi-annual certifications and time and effort logs to ensure time charged to grant awards is allowable and allocable based on work performed in accordance with grant requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.430 states in part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: $2,130 (Known questioned costs) Context: For 5 selections, in a sample of 5 payroll transactions, the School Corporation did not have time and effort logs to support the portion of the employees’ time charged to the grant. The employees’ time was split with a non-federal fund; however, the School Corporation did not have support for the allocation of the time charged to the School Lunch fund. Identification as a repeat finding: No. Recommendation: We recommend management ensure semi-annual certifications are completed for all employees charged to the grant awards at 100% and time and effort logs are maintained for all employees not charged at 100% to support work performed and charged to the grant awards. We recommend management establish a documented review by management of semi-annual certifications and time and effort logs to ensure time charged to grant awards is allowable and allocable based on work performed in accordance with grant requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY2023, FY2024 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.430 states in part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to establish an effective internal control system placed the School Corporation at risk of noncompliance with the grant agreement and the compliance requirements. A lack of segregation of duties within an internal control system could have also allowed noncompliance with the compliance requirements and allowed the misuse and mismanagement of federal funds and assets by not having proper oversight, reviews, and approvals over the activities of the programs. Questioned Costs: $2,130 (Known questioned costs) Context: For 5 selections, in a sample of 5 payroll transactions, the School Corporation did not have time and effort logs to support the portion of the employees’ time charged to the grant. The employees’ time was split with a non-federal fund; however, the School Corporation did not have support for the allocation of the time charged to the School Lunch fund. Identification as a repeat finding: No. Recommendation: We recommend management ensure semi-annual certifications are completed for all employees charged to the grant awards at 100% and time and effort logs are maintained for all employees not charged at 100% to support work performed and charged to the grant awards. We recommend management establish a documented review by management of semi-annual certifications and time and effort logs to ensure time charged to grant awards is allowable and allocable based on work performed in accordance with grant requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
1. FINDING NUMBER:14 2024 - 007 2. THIS FINDING IS: X New Repeat from Prior year? Year originally reported? 3. Federal Program Name and Year: Education Stabilization Fund - PY 2023 4. Project No.: 23-4998-E3 5. AL No.: 84.425 6. Passed Through: Illinois State Board of Education 7. Federal Agency: Department of Education 8. Criteria or specific requirement (including statutory, regulatory, or other citation) According to 2 CFR §200.303 (Internal Controls), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 9. Condition BT noted, during the review of ESSER expenditures, that the District paid the vendor for duplicate invoices. The erroneous invoice passed through all necessary controls, including purchase order/invoice review and approval to payment approval, resulting in the invoice being paid twice to the vendor for a single service. BT noted the total suspected duplicated invoices to be $2,955.67. 10. Questioned Costs No reportable questioned costs noted 11. Context During our audit of allowable activities, two separate instances of duplicated invoices were identified from a stratified sample size of forty. The sample was deemed not statistically valid. 12. Effect The client incurred unnecessary expenses by paying vendors twice for the same service, which could result in financial losses and potential non-compliance with Federal regulations. 13. Cause The District's internal controls failed to identify and prevent the payment of duplicate invoices. 14. Recommendation We recommend that the client implement stronger internal controls over the disbursement process. This includes establishing a review and approval process for all invoices before payment, implementing software controls to detect duplicate invoices, and providing training to staff on proper invoice processing procedures to minimize typographical errors. 15. Management's response Moving forward, our accounts payable coordinator will not adjust invoice numbers in IVEE and instead check the general ledger to ensure payment for that invoice has not already been made. Business Manager will perform a review of the list of bills to ensure there are no duplicate payments.
1. FINDING NUMBER:14 2024 - 007 2. THIS FINDING IS: X New Repeat from Prior year? Year originally reported? 3. Federal Program Name and Year: Education Stabilization Fund - PY 2023 4. Project No.: 23-4998-E3 5. AL No.: 84.425 6. Passed Through: Illinois State Board of Education 7. Federal Agency: Department of Education 8. Criteria or specific requirement (including statutory, regulatory, or other citation) According to 2 CFR §200.303 (Internal Controls), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 9. Condition BT noted, during the review of ESSER expenditures, that the District paid the vendor for duplicate invoices. The erroneous invoice passed through all necessary controls, including purchase order/invoice review and approval to payment approval, resulting in the invoice being paid twice to the vendor for a single service. BT noted the total suspected duplicated invoices to be $2,955.67. 10. Questioned Costs No reportable questioned costs noted 11. Context During our audit of allowable activities, two separate instances of duplicated invoices were identified from a stratified sample size of forty. The sample was deemed not statistically valid. 12. Effect The client incurred unnecessary expenses by paying vendors twice for the same service, which could result in financial losses and potential non-compliance with Federal regulations. 13. Cause The District's internal controls failed to identify and prevent the payment of duplicate invoices. 14. Recommendation We recommend that the client implement stronger internal controls over the disbursement process. This includes establishing a review and approval process for all invoices before payment, implementing software controls to detect duplicate invoices, and providing training to staff on proper invoice processing procedures to minimize typographical errors. 15. Management's response Moving forward, our accounts payable coordinator will not adjust invoice numbers in IVEE and instead check the general ledger to ensure payment for that invoice has not already been made. Business Manager will perform a review of the list of bills to ensure there are no duplicate payments.
1. FINDING NUMBER:14 2024 - 007 2. THIS FINDING IS: X New Repeat from Prior year? Year originally reported? 3. Federal Program Name and Year: Education Stabilization Fund - PY 2023 4. Project No.: 23-4998-E3 5. AL No.: 84.425 6. Passed Through: Illinois State Board of Education 7. Federal Agency: Department of Education 8. Criteria or specific requirement (including statutory, regulatory, or other citation) According to 2 CFR §200.303 (Internal Controls), non-Federal entities must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 9. Condition BT noted, during the review of ESSER expenditures, that the District paid the vendor for duplicate invoices. The erroneous invoice passed through all necessary controls, including purchase order/invoice review and approval to payment approval, resulting in the invoice being paid twice to the vendor for a single service. BT noted the total suspected duplicated invoices to be $2,955.67. 10. Questioned Costs No reportable questioned costs noted 11. Context During our audit of allowable activities, two separate instances of duplicated invoices were identified from a stratified sample size of forty. The sample was deemed not statistically valid. 12. Effect The client incurred unnecessary expenses by paying vendors twice for the same service, which could result in financial losses and potential non-compliance with Federal regulations. 13. Cause The District's internal controls failed to identify and prevent the payment of duplicate invoices. 14. Recommendation We recommend that the client implement stronger internal controls over the disbursement process. This includes establishing a review and approval process for all invoices before payment, implementing software controls to detect duplicate invoices, and providing training to staff on proper invoice processing procedures to minimize typographical errors. 15. Management's response Moving forward, our accounts payable coordinator will not adjust invoice numbers in IVEE and instead check the general ledger to ensure payment for that invoice has not already been made. Business Manager will perform a review of the list of bills to ensure there are no duplicate payments.
2024-001 Procurement Federal Agency: Department of Health and Human Services Program: Social Services Research and Demonstration (ALN 93.647) Pass-through Entity: N/A Federal Assistance Identification Number or Pass-Through Numbers: N/A Federal Award Years: Year ended June 30, 2024 Type of Finding: Material Weakness in Internal Control over Compliance; Other Matter Compliance Finding Criteria: 2 CFR 200.303(a) requires that each non-Federal entity must "Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." 2 CFR 200.320 requires that each non-Federal entity must "have and use documented procurement procedures, consistent with the standards of this section and §§ 200.317, 200.318, and 200.319 for any of the following methods of procurement used for the acquisition of property or services required under a Federal award or sub-award." Condition: While testing the procurement requirement, we noted that internal controls were not properly designed over the procurement requirement. Prior to receiving federal funding beginning in August 2022, the program conducted a request for proposal (RFP) process and began contracting with a vendor. When federal funding was obtained, the vendor was not reevaluated in accordance with the Uniform Guidance to ensure the procurement requirements were being met. In addition, we noted UW Health – Madison’s procurement policy documents do not include all of the information that is required by the Uniform Guidance. Cause: Because the vendor was already in place for the program prior to receiving federal funds, management did not recognize the need to reevaluate the vendor under the requirements of the Uniform Guidance. Management became aware of the need to perform additional procedures to comply with Uniform Guidance part way through the year and completed the evaluation once it became known. However, by that time, the vendor was already charged to the grant prior to the completion of the vendor evaluation. In addition, management also did not recognize the need to include additional information in its procurement policy documents related to the Uniform Guidance. Effect: Without appropriate internal controls, there is an increased risk of noncompliance related to federal funding. Context: We identified and tested 3 vendors that were direct and material to the program and related to the procurement and suspension and debarment requirements. The sample size was based on guidance from chapter 11 of the AICPA Audit Guide, Government Auditing Standards and Single Audits. Questioned Costs: None. Repeat Finding?: Yes Recommendation: While it was determined that the requirements of the Uniform Guidance were met related to the vendor tested, we suggest that management reevaluate all vendors that were previously used prior to receiving federal funding. In addition, we recommend that management update its procurement policies to incorporate the requirements of the Uniform Guidance. View of responsible officials of the auditee: Management agrees with the finding.